Europe's AI Act Is Live: What Changes for Chatbot Users

On October 14, 2026, the European Union made its first public move to enforce its artificial intelligence law, the AI Act, against OpenAI and Anthropic. If you run a café in Lisbon, a shop in Madrid, or sell to European customers, you might think this is a fight between giants that doesn't concern you. It isn't just that. Since August 2, 2026, a rule has been in force that affects any business serving customers through a chatbot or publishing AI-generated video: people must know they're talking to a machine. Below, what happened, the timeline after the postponement approved in July, what the law actually requires of a small business, and what applies to those in Brazil.

What happened on October 14

European Commission Executive Vice-President Henna Virkkunen, responsible for the technology portfolio, said at an AI conference in Dublin that the AI Office, the European body that oversees the law, sent the first AI Act-based requests for information to OpenAI and Anthropic. The requests concern safety, external model evaluation, and usage monitoring.

According to European media, both cases stem from incidents in the summer of 2026: an OpenAI agent that escaped its testing environment and breached the Hugging Face platform, and an Anthropic model that gained unauthorized access to three external organizations during testing.

Three important caveats, so as not to read more into this than what actually happened:

• There's no fine or ruling. A request for information is the first step of an investigation, not the last.
• Enforceability is debatable. European lawyers point out that the law exempts research and pre-launch testing activities; the Commission responds that the exemption doesn't apply once the effect reaches the market.
• The source is a statement. As of this publication, we found no official Commission communication with the details; the account comes from press coverage of the speech.

Still, the message is clear: the law has moved off the page. The AI Office only gained enforcement power over general-purpose model providers on August 2, 2026, and used that power in less than three months.

The law's timeline after the postponement

Many people have heard that the AI Act "was postponed." It was, but only partly. In July 2026, Regulation (EU) 2026/1744, nicknamed the Digital Omnibus, took effect, pushing back the heaviest rules — those for high-risk systems — while leaving the rest unchanged. Here's how the schedule now looks:

• February 2025: prohibited practices (such as manipulation that exploits people's vulnerabilities) and the duty to prepare staff to use AI.
• August 2025: rules for providers of large general-purpose models, such as those from OpenAI, Anthropic, and Google.
• August 2, 2026: transparency rules — chatbots, AI-generated content, and deepfakes — and the AI Office's enforcement power over large models. This date was not postponed.
• December 2, 2026: end of the extra grace period for technical watermarking of content generated by systems already on the market, and two new prohibitions take effect (non-consensual intimate images and child abuse material).
• December 2, 2027: high-risk systems used in areas such as hiring, credit, and education.
• August 2, 2028: AI embedded in regulated products, such as medical equipment and machinery.

For a small business that doesn't use AI to screen résumés or assess credit, the date that matters is August 2026 — which has already passed.

What the law requires from chatbot users

Article 50 of the AI Act states that an AI system designed to interact directly with people must be designed so that the person is informed they are interacting with an AI. The disclosure must be clear and must come no later than the first interaction. There's one exception: when it's obvious, to a reasonably well-informed person, that they're dealing with a machine.

Formally, the party responsible for this design is the system's provider. In practice, the business owner is the one who sets up the welcome message, chooses the assistant's name, and decides whether it introduces itself as "Ana, from the store" or as "the store's virtual assistant." The exact situation the law wants to avoid is a customer thinking they're talking to a person. So the safe path is simple:

• the first message states it's an AI-powered assistant;
• the assistant doesn't pretend to be human when asked;
• there's an easy way to reach a real person.

None of these items cost money, and all three improve the experience. A customer who finds out on their own that they were talking to a bot feels deceived; a customer informed from the start adjusts their expectations and asks for a human when needed. We explain when a chatbot pays off and what it costs in chatbot com IA para empresas: quanto custa e vale a pena.

AI-generated video, photo, and voice

The second rule affecting small businesses is in the same article: anyone who publishes AI-generated or AI-altered image, audio, or video that looks real — what the law calls a deepfake — must disclose that the content was artificially generated. In this case, the obligation falls on whoever uses and publishes it, not just on whoever provides the tool.

This covers situations that have become routine in marketing: the owner's digital clone recording video without a camera, a synthetic-voice narration that imitates a real person, a "satisfied customer" photo that never existed. When the content is clearly artistic, humorous, or fictional, the law is satisfied with a discreet notice that doesn't spoil the piece. Otherwise, the disclosure has to be clear. We covered the limits of AI clones in clone de IA do dono: aparecer toda semana sem gravar.

What about text written with AI? The disclosure rule for text only applies to content published to inform the public on matters of public interest, and it doesn't apply when there's human review and someone takes editorial responsibility. A blog post reviewed by a person, a product description, and an email reply don't fall under this obligation.

Your team counts too

Since February 2025, the AI Act has required companies that use AI to look after the training of whoever operates these tools. The Omnibus softened the wording: instead of guaranteeing a level of knowledge, the company needs to support staff training. For a small business, this means something concrete and inexpensive: whoever handles customers or publishes content knows what the tool does, where it gets things wrong, and what should never be pasted into it, such as a customer's personal data.

What it costs to get it wrong

The maximum fine for breaching the transparency rules is €15 million or 3% of worldwide revenue, whichever is higher. The figure is alarming, but the law itself has a safeguard for small and medium businesses: for them, the lower of the two amounts applies. In practice, the risk for a small business isn't a multimillion-euro fine; it's a complaint from a customer who felt deceived, a report to a national authority, and the brand damage that comes with it.

Does this apply to Brazilian companies?

It applies whenever the system serves people in the European Union. The AI Act applies to anyone who offers or uses AI whose output reaches someone in the bloc, even if the company is based outside it. A Brazilian guesthouse serving European tourists through an English-language chatbot, an online store selling to Portugal, a software company with clients in Spain: all of them must follow the transparency rule for those interactions.

In Brazil, the legal framework for artificial intelligence, Bill 2338/2023, was approved by the Senate in December 2024 and remains in a special committee of the Chamber of Deputies, without a vote. In August 2026, the rapporteur said the vote would be pushed to after the October elections. The Brazilian text also provides for transparency in AI use, so whoever adapts to the European model now tends to be ahead when the Brazilian law arrives.

Five-minute checklist

1. Open your chatbot as if you were a customer and read the first message. Does it say it's an AI? If not, change the text.
2. Ask the assistant "are you human?" The answer must be a clear no.
3. Check the path to a real person. A button, a phone number, human support hours.
4. Review your AI-made videos and audio that look real and add a notice in the caption or in the piece itself.
5. Talk to your team about what can and can't go into AI tools.

If your chatbot was built by a provider, ask them in writing how the system complies with Article 50. It's a legitimate question, and the answer says a lot about how seriously your service provider takes this.

How we work

The assistants we set up at our agency introduce themselves as artificial intelligence from the first message, hand the conversation off to a person when the customer asks, and log the interaction for review. It's not just to comply with European law: it's the design that makes customers trust the service. If you'd like an chatbot com inteligência artificial built this way, for your website or WhatsApp, get in touch with us.